Tuesday, 21 June 2016

It was time to setup a way of getting secure access to my network while away and also to get a secure connection to the Interwebs while away from home, it also means that I can watch BBC Iplayer as if I'm at home.I'm installing this on an old machine running Debian Jessie, it should work on a Raspberry Pi too, the only things I have installed during the initial setup process as the standard Debian utilities and ssh server so I can do everything remotely.I've found lots on instructions out there but the one from this website was the easiest to follow, I've modified it slightly to make it easier to get at the keys.I've modified a few things myselfFirst thing is to ensure we are up to date, lets switch to root for the installsuthenapt-get updateapt-get upgradeTime to start installing stuffapt-get install openvpn easy-rsa

Then copy some example files over to make the job easier

cp -r /usr/share/easy-rsa/ /etc/openvpn

mkdir /etc/openvpn/easy-rsa/keys

Now we edit the certificate variables

nano /etc/openvpn/easy-rsa/vars

# These are the default values for fields

# which will be placed in the certificate.

# Don't leave any of these fields blank.

export KEY_COUNTRY="changeme"

export KEY_PROVINCE="changeme"

export KEY_CITY="changeme"

export KEY_ORG="example"

export KEY_EMAIL="changeme@example.com"

export KEY_OU="changeme"

# X509 Subject Field

export KEY_NAME="server"

Time to generate some stuff and go and have a coffee, on a Pi, this may take some time

openssl dhparam -out /etc/openvpn/dh2048.pem 2048

Now we make the server certificate keys:

cd /etc/openvpn/easy-rsa. ./vars./clean-all./build-ca./build-key-server serverLet's copy them to where they belongcp /etc/openvpn/easy-rsa/keys/{server.crt,server.key,ca.crt} /etc/openvpn

Now time to make some changes to the network settings:

echo 1 > /proc/sys/net/ipv4/ip_forward

And let's make the changes permanent with:

nano /etc/sysctl.conf

Look for the following bit:# Uncomment the next line to enable packet forwarding for IPv4# net.ipv4.ip_forward=1

Then remove the # from the second line so it looks like this:# Uncomment the next line to enable packet forwarding for IPv4net.ipv4.ip_forward=1Now we make the server config file:nano /etc/openvpn/server.confPaste this lot into the empty file, this will run the VPN server on port 1194.port 1194proto udpdev tunca ca.crtcert server.crtkey server.key dh dh2048.pemserver 10.90.10.0 255.255.255.0ifconfig-pool-persist ipp.txtpush "redirect-gateway def1 bypass-dhcp"push "dhcp-option DNS 8.8.8.8"client-to-clientduplicate-cnkeepalive 10 120cipher AES-128-CBCcomp-lzouser nobodygroup nogrouppersist-keypersist-tunstatus logs/status.loglog-append logs/openvpn.logverb 3

Now we make the log files:mkdir -p /etc/openvpn/logstouch /etc/openvpn/logs/{openvpn,status}.logAnd let's do some firewall configuration:iptables -t nat -A POSTROUTING -s 10.90.10.0/24 -o eth0 -j MASQUERADEiptables-saveNow let's restart the server to put the changes into place:systemctl restart openvpn@server.serviceNow the original instructions came with a script file to help you create new keys for each user and device, pointless changing it.nano /etc/openvpn/gen-client.sh

Save it and then make it executable with:chmod +x /etc/openvpn/gen-client.shNext we have to create the template file for this to use:mkdir -p /etc/openvpn/clients/.tmp/nano /etc/openvpn/clients/.tmp/.tmp.ovpnPaste this in, change example.com for your external IP or server addressclientverb 1dev tunproto udpport 1194remote example.com 1194 udpremote-cert-tls serverresolv-retry infinitenobindpersist-keypersist-tuncomp-lzocipher AES-128-CBCNow, let's make some keys:cd /etc/openvpn/

replace username with your username, I'm going to install this onto an S5 so it will be freds5 or something.

./gen-client.sh username

To make it easy to get the files off the server and onto my device, I've decided to install Samba and setup the client keys folder as a Windows share, this is how this is done.apt-get install samba samba-commonOnce it's finished we edit the Samba config file:nano /etc/samba/smb.confChange the workgroup name at the top of the file and you can also add:netbios name = servername under it if you want.Add the bottom add the following[VPNKeys] path = /etc/openvpn/clients/ browseable = yes public = yes writeable = no

Restart the server with:

service smbd restart

Just got to change the folder permissions to make sure we can get the files off:

chmod 0777 -R /etc/openvpn/clients

Onto my phone now, I've installed OpenVPN Connect from the play store, then I've copied the files from the Windows share into dropbox, then saved them into a folder on the phone called VPN, you could just install a file browser and do the same.

Then import the .ovpn file into OpenVPN connect and click on connect.One last thing, make sure you give the server a static IP and forward port 1194 on the router.

Tuesday, 14 June 2016

The Chevy Aveo managed to do about 65,000 miles with no issues apart from some bushes on the front suspension, some tyres and new brake pads. Then one night, a failure occurred that actually prevented the car from being driven.

The passenger headlight bulb died.

Now this is one area where Chevrolet have really let the side down. The last time I had to change a bulb on a car was on a Renault Laguna, I had to dislocate a couple of fingers and peel a few layers of skin off my hand to replace that bulb. On some of the new Fords, you have to remove the front bumper to replace a bulb, on one French car you have to replace it by going in through the exhaust with a specially designed bulb replacement tool only available from the Albanian spare department on a Thursday afternoon in September and on on Italian car you can only replace the bulb from the passenger seat of a car parked in front of you, providing it's not a blue Vauxhall Astra.

So on the Chevy, I expected to at the very least to have to put the car over a manhole cover and go in from the underneath. But no, on this car you open the bonnet (hood if you're reading this in the colonies), pull a plug off the back of the bulb, remove the waterproof seal, unclip the bulb and put the new one in, you can even use 2 hands.

Honestly, in this day and age you would expect this to be far more complicated, the makers have even put the oil filter at the front in such a position that you can get hold of it easily. What were they thinking.

The whole bulb replacement process should take at least a few hours with specialised tools these day instead of the 5 minutes it took me in the dark.